Address Sanitizer Internals

Post by nneonneo » Sun, Jun 16, 2024, 1:04 PM UTC

adrian_b wrote: post #21

nneonneo wrote: post #18

Earlier quoted context omitted.

Pray tell: what magic C/C++ compiler options do I add to enable deterministic OOB checks that never produce any false positives or negatives?

If you had bothered to search the gcc or clang manual, you would have found e.g. "-fsanitize=bounds-strict". There is nothing magic about this option. With it C or C++ is compiled exactly like any other programming language where array bounds checking is implicit. That means that whenever a new value is computed for a pointer or index that will be used to access an array, the value is compared with the bounds associa…

    #include 

    int main(int argc, char **argv) {
        printf("%s\n", argv[-8]);
    }

    #include 
    
    int foo(volatile char *x) {
        return x[0] + x[-64];
    }
    
    int main(int argc, char **argv) {
        char x[1] = {42};
        printf("%d\n", foo(x));
    }

Post by mike_hock » Sun, Jun 16, 2024, 7:04 PM UTC

shric wrote: post #19

"For this article, you’ll need the following knowledge: Basic C understanding (Memory, Stack, Heap, Syscall)." Obviously, since C doesn't prescribe any kind of heap, stack or syscall behavior (or if they even exist), I assume the author meant something like "Basic understanding of how C is often implemented on certain operating systems and hardware".

Post by atiedebee » Sun, Jun 16, 2024, 7:44 PM UTC

adrian_b wrote: post #15

skobes wrote: post #9

Earlier quoted context omitted.

I've never seen that particular claim either, but I did previously believe that asan would reliably detect an out-of-bounds write if and when it occurs. So I learned something new from the OP (that this type of false negative is possible).

ASAN, i.e. "-fsanitize=address" is a completely different and unrelated sanitizer than checking out-of-bounds accesses, like "-fsanitize=bounds-strict". Checking out-of-bounds accesses must detect any out-of-bounds access done at run time. It is done by comparing the pointers or indices used for access with the array bounds. (At least for gcc: "Initializers of variables with static storage are not instrumented.") Out…

Post by nneonneo » Mon, Jun 17, 2024, 2:21 AM UTC

searealist wrote: post #27

yosefk wrote: post #25

Earlier quoted context omitted.

adrian_b's comments in this thread are the kind of thing I referred to (my point wasn't that ASan specifically is presented as a panacea but rather various sanitizers in general.)

Adrian's comments are nuanced and truthful. He said gcc offers an out-of-bounds sanitizer and listed some limitations. He does not say it makes C++ memory safe.

Post by saagarjha » Tue, Jun 18, 2024, 12:46 PM UTC

adrian_b wrote: post #23

nneonneo wrote: post #22

Earlier quoted context omitted.

Weird, the following program compiles and runs without complaint under `-fsanitize=bounds-strict,address,undefined` and outputs the rather fetching output `��1�I��^H��H���PTE1�1�H�Ǧ@`: #include int main(int argc, char **argv) { printf("%s\n", argv[-8]); } ( https://godbolt.org/z/ef8KMGnce - feel free to try other values to dump out environment variables and other stack crap) Oh, but maybe that's because the compil…

You did not use arrays, so there were no bounds to be checked. The C language indeed allows the use of pointers having arbitrary values that cannot be checked in any way. However it is trivial to avoid the use of such pointers and any decent programmer will never use such pointers, because they are never needed. Unfortunately, it is difficult to forbid the use of such pointers, because there are too many legacy progr…